tickmarkr 1.96.0 → 2.0.0

package/dist/compile/collateral.js

@@ -3,8 +3,12 @@ import { extname, join, relative } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import { criticalPathHits, DEFAULT_CONFIG, DEFAULT_REVIEW_CRITICAL_PATHS, effectiveReviewPolicy, loadConfig, } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
-// Advisory plan-time scan only (OBS-12/13/14/21, OBS-76). NEVER expands files[], fails compile,
-// or feeds the scope gate — a warning the author acts on. Plain-text (no AST), capped + sorted.
+// Advisory scan (OBS-12/13/14/21, OBS-76). NEVER expands files[] or fails compile — a warning the
+// author acts on. Plain-text (no AST), capped + sorted for DISPLAY only.
+// OBS-547: the collateral prediction is no longer plan-time-only. The daemon computes one full
+// (uncapped) map per run and hands each task's slice to its scope gate, which classifies a red
+// against it — the prediction never causes a refusal, it only says whether a red the gate already
+// found was foreseeable (authoring defect) or not (chargeable quality failure).
 /** Max files walked per root (sorted walk; rest ignored). */
 const MAX_WALK_FILES = 400;
 /** Max collateral test paths listed per task. */
@@ -95,15 +99,17 @@ function makeReader(repoRoot) {
     };
 }
 /**
- * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
- * Each line names the task id and at least one missing collateral test path.
+ * OBS-547: the FULL per-task collateral prediction, uncapped. ONE map is computed per run (daemon.ts,
+ * at run start) and handed whole to the scope gate, so a hit the plan display hides is still there
+ * when the gate asks about it. The lint lines below are a capped VIEW of this same map — never a
+ * second scan. Tasks with no hits are absent.
  */
-export function collateralLints(tasks, repoRoot) {
+export function collateralHits(tasks, repoRoot) {
+    const map = new Map();
     const testFiles = walkCode(repoRoot, "tests");
     if (!testFiles.length)
-        return [];
+        return map;
     const read = makeReader(repoRoot);
-    const lines = [];
     for (const t of tasks) {
         // OBS-22: scopeGate accepts picomatch globs; advisory collateral warnings must agree.
         const scoped = filesGlob(t.files.map((f) => f.replace(/^\.\//, "")));
@@ -122,14 +128,43 @@ export function collateralLints(tasks, repoRoot) {
             if (mentions(text, needles))
                 hits.push(tf);
         }
-        if (!hits.length)
-            continue;
         // deterministic: walk already sorted; stable list
+        if (hits.length)
+            map.set(t.id, hits);
+    }
+    return map;
+}
+/** The verbatim repair an authoring defect owes: the files[] lines the spec is missing. */
+export function filesRepair(taskId, paths) {
+    return paths.map((p) => `add ${p} to ${taskId}.files[]`).join("\n");
+}
+/**
+ * OBS-547: cross-reference at the RED. The gate supplies specificity (the paths actually touched),
+ * the prediction supplies classification — so there are no false positives to fear and no refusal to
+ * author. Feed this the FULL map for the task: a classifier bounded by the display cap calls a
+ * predicted 21st hit a quality failure.
+ */
+export function classifyScopeOffenders(taskId, hard, predicted) {
+    const named = new Set(predicted);
+    const hit = hard.filter((f) => named.has(f));
+    const missed = hard.filter((f) => !named.has(f));
+    return { authoring: hard.length > 0 && missed.length === 0, predicted: hit, missed, repair: filesRepair(taskId, hit) };
+}
+/**
+ * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
+ * Each line names the task id and at least one missing collateral test path.
+ */
+export function collateralLints(tasks, repoRoot) {
+    const lines = [];
+    for (const [id, hits] of collateralHits(tasks, repoRoot)) {
         const listed = hits.slice(0, MAX_HITS_PER_TASK).join(", ");
+        // OBS-547: the cap hides names, never predictions. Say so, and say where the hidden ones surface —
+        // a count with no route is exactly what left one run's victim unreadable.
         const tail = hits.length > MAX_HITS_PER_TASK
-            ? ` (${hits.length} total; capped at ${MAX_HITS_PER_TASK} shown)`
+            ? ` (${hits.length} total; ${MAX_HITS_PER_TASK} shown, ${hits.length - MAX_HITS_PER_TASK} capped out of view`
+                + ` but RETAINED for the scope gate — a matching scope red prints the hidden path with its files[] repair)`
             : "";
-        lines.push(`${t.id}: likely collateral tests not in files[]: ${listed}${tail}`);
+        lines.push(`${id}: likely collateral tests not in files[]: ${listed}${tail}`);
     }
     return lines;
 }

package/dist/compile/native.js

@@ -728,6 +728,16 @@ acceptance is required on every task (a nested list of observable outcomes).
     - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
       site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
       every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
+    - EVERY CRITERION NAMES THE PAIR IT DISCRIMINATES: the correct case that MUST PASS, and the
+      neighbouring plausible-wrong or false-clean case that MUST FAIL. Two easy examples that both pass are
+      not discrimination — they are two ways of being green, and the wrong half is the whole point: it is
+      what a reader would mistake for the mechanism, its VOCABULARY without its behaviour. Measured three
+      times in three days, each a criterion that pinned vocabulary instead of the discriminating case: a
+      suite that pinned an alarm's text while the alarm itself went unpinned; an export asserted SOMEWHERE,
+      which says nothing about the environment a process actually receives; and a gate green on "infra is
+      what execution says" while a signalled oracle still charged an attempt. Each was satisfied exactly as
+      written and each shipped the defect. If you cannot name the case that must FAIL, you have named a
+      topic, not a criterion — and the "so X fails" clause that ends a good criterion is where it goes.
     - A criterion that names a behaviour must name the VALUE AT WHICH IT WOULD BREAK. Every criterion is a
       claim about a variable — a status, a width, a count, an arrival time — and if it does not say which
       value of that variable is the hard one, THE TEST WILL CHOOSE THE EASY ONE AND BE GREEN. Measured: a

package/dist/drivers/herdr.d.ts

@@ -1,3 +1,4 @@
+import { type JournalEvent } from "../run/journal.js";
 import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
 export declare const TRAILER_SAFE_FLOOR_COLS = 108;
 export declare const TRAILER_WIDTH_MARGIN = 2;
@@ -22,20 +23,20 @@ export declare class DeliveryCorruptedError extends Error {
 export type DriverJournal = (event: string, slotName: string, data: Record<string, unknown>) => void;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
-export declare const BOARD_TARGET_COLS = 110;
-export declare const BOARD_SEAT_FLOOR_COLS = 40;
-export interface BoardSplitPlan {
-    direction: "right" | "down";
-    /** herdr's split ratio is the FIRST child's share and a right split's first child is the caller,
-     *  so this is what the SEAT keeps. Absent on `down` — the board then takes the full width. */
-    ratio?: number;
-    /** Columns the board gets under this plan; null when it takes the caller's whole width. */
-    boardCols: number | null;
+export declare const BOARD_HEIGHT_SHARE = 0.72;
+export interface BoardPlacement {
+    /** Always down: the split is vertical, so the board can own the caller's FULL width. */
+    direction: "down";
+    /** herdr's split ratio is the FIRST child's share, and a down split's first child is the TOP
+     *  region — the region the board occupies once it is swapped above the caller. */
+    ratio: number;
+    /** The new pane is swapped ABOVE the caller; the split alone would leave the board underneath. */
+    swap: "above";
 }
-/** Board-first placement beside the supervising seat: right only while the caller can fund the board
- *  its target AND leave the seat its floor; otherwise down at full width, never a squeezed board.
- *  An unmeasurable caller falls back to down like every other placement here (fail closed). */
-export declare function boardSplitPlan(callerCols: number | null, boardCols?: number, seatFloor?: number): BoardSplitPlan;
+/** The single approved vertical-stack record. The caller's columns are accepted and deliberately
+ *  ignored: this signature is where width used to decide the arrangement, and the parameter stays
+ *  so that "the plan does not depend on it" is a property a caller (and a test) can exercise. */
+export declare function boardSplitPlan(_callerCols?: number | null): BoardPlacement;
 export declare function taskGroupOf(name: string): string | undefined;
 /** The operator-facing TITLE for a tab this driver creates when no stage label is supplied: a task
  *  token for a worker (`T5`, `T5↻2` on a retry) and ROLE + task for a gate pane (`REVIEW T5`) — the
@@ -63,11 +64,14 @@ export declare class HerdrDriver implements ExecutorDriver {
     private inputBoxes;
     private bootstraps;
     private journalRoots;
+    private narrate?;
     private ws;
     private callerPane;
     private watches;
     constructor(bin?: string, workersPerTab?: number, time?: HerdrTimeSource, journal?: DriverJournal | undefined);
     private appendDispatchRetry;
+    /** v1.99 T2: bind this driver's own journal writes to the run's live narration sink. */
+    narrateWith(narrate: (event: JournalEvent) => void): void;
     private serial;
     private deliveryQueue;
     private reserveDispatch;
@@ -77,6 +81,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     static available(): boolean;
     private herdr;
     private namedPaneId;
+    private paneStillOpen;
     private paneId;
     private paneWidth;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
@@ -116,6 +121,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private closeGrouped;
     private ownedWatchPanes;
     private watchSlot;
+    private discardSplit;
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
     reconcile(desired: Set<string>, runId: string, opts?: {
         spareLiveLlm?: boolean;

package/dist/drivers/herdr.js

@@ -69,19 +69,19 @@ export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_CO
 }
 // The watch board's geometry, deliberately NOT the trailer floor above. `workerSplitDirection`
 // halves the caller and refuses a right split under 108+2 — that bound protects WORKER panes, which
-// print a trailer; the supervising seat + board pair does not. Applied to that pair on 2026-08-18 it
-// sent a 189-column tab's board BELOW the seat and the operator corrected it (QUEUE-v194 criterion 1;
-// skills/tickmarkr-overseer/SKILL.md: "the side placement outranks the halving floor"). So the board
-// is allocated its measured width FIRST and the seat keeps the remainder.
-export const BOARD_TARGET_COLS = 110; // §14a measured clean-render bound for the board
-export const BOARD_SEAT_FLOOR_COLS = 40; // the seat beside it still has to be usable
-/** Board-first placement beside the supervising seat: right only while the caller can fund the board
- *  its target AND leave the seat its floor; otherwise down at full width, never a squeezed board.
- *  An unmeasurable caller falls back to down like every other placement here (fail closed). */
-export function boardSplitPlan(callerCols, boardCols = BOARD_TARGET_COLS, seatFloor = BOARD_SEAT_FLOOR_COLS) {
-    if (callerCols == null || callerCols < boardCols + seatFloor)
-        return { direction: "down", boardCols: null };
-    return { direction: "right", ratio: Math.round(((callerCols - boardCols) / callerCols) * 1e4) / 1e4, boardCols };
+// print a trailer; the supervising seat + board pair does not, and neither does the board's own
+// placement any more. Every width-derived variant of this placement has been wrong in the operator's
+// tab: the halving floor sent a 189-column board below the seat (2026-08-18), and the width-first
+// side split that replaced it puts the board and the narration shoulder to shoulder when the board is
+// the surface the operator reads and the narration is the rail beneath it. The placement is now ONE
+// record — the board stacked ABOVE the caller at full width, taking 72% of the height — and it is
+// invariant: no terminal width, measured or unmeasurable, can select a different arrangement.
+export const BOARD_HEIGHT_SHARE = 0.72; // board 72 / narration 28, the operator's stack
+/** The single approved vertical-stack record. The caller's columns are accepted and deliberately
+ *  ignored: this signature is where width used to decide the arrangement, and the parameter stays
+ *  so that "the plan does not depend on it" is a property a caller (and a test) can exercise. */
+export function boardSplitPlan(_callerCols) {
+    return { direction: "down", ratio: BOARD_HEIGHT_SHARE, swap: "above" };
 }
 /** The tab a slot belongs to: its TASK — worker, judge, review and consult panes for one task share it.
  *  Returns undefined for everything else, which keeps those on the dedicated-tab path.
@@ -147,6 +147,7 @@ export class HerdrDriver {
     // the caller launched tickmarkr elsewhere (process.cwd is not run identity). The repo itself is
     // also bound for judge/review/consult slots whose cwd is the root rather than a task worktree.
     journalRoots = new Map();
+    narrate;
     // VIS-10: the run's workspace id, captured once at construction (the daemon inherits it from the
     // operator's env before the driver is built). Required at slot() time, never in the constructor —
     // pickDriver and its unit test construct HerdrDriver without env, so slot() is the trust gate.
@@ -176,7 +177,14 @@ export class HerdrDriver {
         if (!repoRoot) {
             throw new Error(`cannot journal dispatch-retry: slot ${slot.name} has no daemon repo binding for ${slot.cwd}`);
         }
-        Journal.open(repoRoot, owned.runId).append("dispatch-retry", owned.taskId, data);
+        // Bound to the live narration sink (`narrateWith`): this Journal is the driver's own — the
+        // daemon never appends this event and never sees it — so an unbound handle here persists the
+        // recovery to the file and the pipe while the operator's rail stays silent about it.
+        Journal.open(repoRoot, owned.runId, this.narrate).append("dispatch-retry", owned.taskId, data);
+    }
+    /** v1.99 T2: bind this driver's own journal writes to the run's live narration sink. */
+    narrateWith(narrate) {
+        this.narrate = narrate;
     }
     serial(fn) {
         const p = this.groupSerial.then(fn, fn);
@@ -274,6 +282,20 @@ export class HerdrDriver {
             return null;
         }
     }
+    // Is this pane id still in the listing? FAIL CLOSED: a listing we cannot read cannot prove a pane
+    // gone, and the caller uses this to decide whether a pane it tried to close is really off screen.
+    async paneStillOpen(paneId) {
+        const r = await this.herdr(`pane list`);
+        if (r.code !== 0)
+            return true;
+        try {
+            const panes = JSON.parse(r.stdout).result?.panes;
+            return !Array.isArray(panes) || panes.some((p) => p.pane_id === paneId);
+        }
+        catch {
+            return true;
+        }
+    }
     // Before delivery, resolve fresh via the durable name because pane ids can compact. After delivery,
     // pin the verified target so early liveness cannot drift to a label rebound onto another pane.
     async paneId(slot) {
@@ -1059,19 +1081,18 @@ export class HerdrDriver {
             return p.workspace_id === this.ws && typeof p.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run";
         }).map((p) => p.pane_id);
     }
-    // T2: the watch is a sibling of the daemon's own pane, never a separate tab — beside it when the
-    // tab can fund the board its width, below it at full width when it cannot. Its durable owned name
-    // is how a later daemon RECOGNIZES the board it must retire, so a run never stacks a second one.
+    // T2: the watch is a sibling of the daemon's own pane, never a separate tab — stacked ABOVE it at
+    // the caller's full width, always, whatever the terminal measures. Its durable owned name is how a
+    // later daemon RECOGNIZES the board it must retire, so a run never stacks a second one.
     async watchSlot(cwd, name) {
         if (!this.ws)
             throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID — refusing unseeded pane");
         if (!this.callerPane)
             throw new Error("herdr watch placement requires HERDR_PANE_ID — refusing untargeted split");
-        // Board width first (boardSplitPlan), measured off the caller through the driver's own layout
-        // read — never an unconditional right split, and never the worker halving rule.
-        const plan = boardSplitPlan(await this.paneWidth(this.callerPane));
-        const ratio = plan.ratio == null ? "" : ` --ratio ${plan.ratio}`;
-        const sp = await this.herdr(`pane split ${shq(this.callerPane)} --direction ${plan.direction}${ratio} --no-focus`);
+        // One invariant placement (boardSplitPlan): split the caller down, then swap the new pane above
+        // it. No layout read decides this — width chose the arrangement twice and was wrong twice.
+        const plan = boardSplitPlan();
+        const sp = await this.herdr(`pane split ${shq(this.callerPane)} --direction ${plan.direction} --ratio ${plan.ratio} --no-focus`);
         if (sp.code !== 0)
             throw new Error(`herdr watch split failed: ${sp.stderr || sp.stdout}`);
         let pane;
@@ -1083,18 +1104,59 @@ export class HerdrDriver {
         }
         if (typeof pane !== "string" || !pane)
             throw new Error(`herdr watch split returned no pane id: ${sp.stdout}`);
+        // The split leaves the board UNDER the caller; the swap is what makes the stack the requested
+        // one. Verified, not assumed: a swap that failed would leave a board below the narration while
+        // the daemon reported the geometry it asked for. Instead the split pane is closed and the failure
+        // propagates — the daemon swallows it and runs boardless, which is honest about what is on screen.
+        // `pane swap` answers a no-op with a ZERO exit and `changed:false` (herdr socket API: a swap it
+        // declined is a non-error response), so an exit code alone proves nothing about the geometry —
+        // that is exactly the path that would leave the board below the narration while the daemon
+        // reported the stack. The documented `changed` flag is the verification; anything else — a
+        // nonzero exit, `changed:false`, an unparseable result — fails closed.
+        const swapped = await this.herdr(`pane swap --source-pane ${shq(pane)} --target-pane ${shq(this.callerPane)}`);
+        let swapChanged;
+        try {
+            swapChanged = JSON.parse(swapped.stdout).result?.changed;
+        }
+        catch {
+            /* fail closed below */
+        }
+        if (swapped.code !== 0 || swapChanged !== true) {
+            await this.discardSplit(pane, `herdr watch swap ${plan.swap} failed: ${swapped.code !== 0
+                ? swapped.stderr || swapped.stdout
+                : `herdr reported no swap took place: ${swapped.stdout || swapped.stderr}`}`);
+        }
         const renamed = await this.herdr(`pane rename ${shq(pane)} ${shq(name)}`);
         if (renamed.code !== 0 || await this.namedPaneId(name) !== pane) {
-            await this.herdr(`pane close ${shq(pane)}`);
-            throw new Error(`herdr watch rename failed: ${renamed.stderr || renamed.stdout}`);
+            await this.discardSplit(pane, `herdr watch rename failed: ${renamed.stderr || renamed.stdout}`);
         }
         const seed = await this.herdr(`pane run ${shq(pane)} ${shq(`cd ${shq(cwd)}; export HERDR_WORKSPACE_ID=${shq(this.ws)}; ${herdrSealShellPrefix()}`)}`, cwd);
         if (seed.code !== 0) {
-            await this.herdr(`pane close ${shq(pane)}`);
-            throw new Error(`herdr watch seed failed: ${seed.stderr || seed.stdout}`);
+            await this.discardSplit(pane, `herdr watch seed failed: ${seed.stderr || seed.stdout}`);
         }
         return { id: pane, name, cwd };
     }
+    // A board that could not be placed costs the OPERATOR a stray pane unless the split is really
+    // taken back, so every close is followed by a pane-list verification rather than issued and
+    // forgotten. A nonzero close and a success that frees nothing are both diagnosed from that same
+    // observation. The daemon swallows it either way and runs boardless — but never silently keeps a
+    // split the geometry it asked for does not include.
+    async discardSplit(pane, why) {
+        const closed = await this.herdr(`pane close ${shq(pane)}`);
+        const stillOpen = await this.paneStillOpen(pane);
+        const orphan = stillOpen
+            ? closed.code !== 0
+                ? closed.stderr || closed.stdout || `exit ${closed.code}`
+                : "close reported success but the pane could not be proven absent from pane list"
+            : null;
+        if (orphan !== null) {
+            // The daemon swallows narrator failures whole (visibility is never a gate), so the thrown
+            // error dies in its catch. This line is the operator's only notice that a pane they did not
+            // ask for is still on their screen and that no process will take it back.
+            console.error(`tickmarkr: the watch split ${pane} survived its close (${orphan}) — close it by hand; the run continues boardless`);
+        }
+        throw new Error(orphan === null ? why : `${why} — and the split pane ${pane} survived its close (${orphan})`);
+    }
     // T6 narrator: the run's single live status surface, RUNNING THE COMMAND THIS CALL SUPPLIED. Only
     // a board this driver instance itself opened is reused (this.watches); any other surviving board —
     // a prior run's, or one already carrying this run's canonical name after a resume — is retired and

package/dist/drivers/types.d.ts

@@ -1,3 +1,4 @@
+import type { JournalEvent } from "../run/journal.js";
 export interface Slot {
     id: string;
     name: string;
@@ -75,6 +76,7 @@ export interface ExecutorDriver {
     nudge?(slot: Slot, message: string): Promise<boolean>;
     notify(msg: string, opts?: NotifyOpts): Promise<void>;
     close(slot: Slot): Promise<void>;
+    narrateWith?(narrate: (event: JournalEvent) => void): void;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
     reconcile?: (desired: Set<string>, runId: string, opts?: {

package/dist/gates/acceptance.js

@@ -179,20 +179,30 @@ function tail(out, n = 8) {
     return "\n" + t.split("\n").slice(-n).join("\n");
 }
 /**
- * OBS-540: classify only bytes produced by the deterministic oracle process. A nonzero command with
- * an infra-only output shape returned no product verdict, so it remains fail-closed but cannot be
- * billed as a diff failure. Judge reasons never reach this helper: the judge path starts after the
- * deterministic loop and a parsed refusal is an evaluated quality verdict whatever its prose says.
+ * OBS-540/551: classify only execution evidence produced by the deterministic oracle process. That
+ * includes its output, exit status and runner-reported test count — never judge-authored prose. A
+ * nonzero command with an infra-only output shape, one of the enumerated signal exits, or a zero-run
+ * report without a failure identity returned no product verdict, so it remains fail-closed but cannot
+ * be billed as a diff failure. A parsed judge refusal is an evaluated quality verdict whatever its
+ * prose says. As in baseline classification, a named regression remains a verdict even if teardown
+ * later exits through a signal.
  */
 function oracleExecutionFailure(label, code, stdout, stderr) {
     const output = [stderr, stdout].filter((part) => part.length > 0).join("\n");
     const classification = classifyFailureOutput(output);
-    if (classification === "infra") {
+    const signalName = code === 143 ? "SIGTERM" : code === 137 ? "SIGKILL" : undefined;
+    const signalKilled = signalName !== undefined && classification !== "regression";
+    const signalEvidence = signalKilled
+        ? `signal-shaped exit ${code} (${signalName}); `
+        : "";
+    const zeroRun = testsRan(output) === 0 && classification !== "regression";
+    const zeroRunEvidence = zeroRun ? "the runner reported zero tests run and no failure identity; " : "";
+    if (classification === "infra" || signalKilled || zeroRun) {
         return {
             gate: "acceptance",
             pass: false,
-            details: `oracle failed: ${label} (exit ${code}) — infrastructure blocked execution before a verdict; this oracle verified nothing${tail(output)}`,
-            meta: { cause: "oracle-execution", classification, infra: true, retryable: false },
+            details: `oracle failed: ${label} (exit ${code}) — ${signalEvidence || zeroRunEvidence}infrastructure blocked execution before a verdict; this oracle verified nothing${tail(output)}`,
+            meta: { cause: "oracle-execution", classification: "infra", infra: true, retryable: false },
         };
     }
     return {

package/dist/gates/llm.d.ts

@@ -33,6 +33,25 @@ export interface GateVia {
     nameFor: (role: "judge" | "review", adapter: string) => string;
     labelFor: (role: "judge" | "review") => string;
 }
+export declare const GATE_INACTIVITY_WINDOW_MS: number;
+/** Test seam — shrink only the calibrated inactivity window; production always reads 12 minutes. */
+export declare function setGateInactivityWindowMsForTests(ms: number): void;
+export declare function resetGateInactivityWindowMsForTests(): void;
+export interface GateCpuAccountant {
+    start(): Promise<void>;
+    read(): {
+        cpu: {
+            ms: number;
+            resolutionMs: number;
+        } | undefined;
+        gaps: number;
+    };
+    stop(): Promise<void>;
+}
+export type GateCpuAccountantFactory = (marker: string, cwd: string) => GateCpuAccountant;
+/** Test seam for deterministic measurable/activity/gap samples without platform-specific ps output. */
+export declare function setGateCpuAccountantFactoryForTests(factory: GateCpuAccountantFactory): void;
+export declare function resetGateCpuAccountantFactoryForTests(): void;
 export declare function captureLlmOutput<T>(run: () => Promise<T>): Promise<{
     value: T;
     outputs: string[];

package/dist/gates/llm.js

@@ -6,6 +6,7 @@ import { join } from "node:path";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { sh } from "../run/git.js";
+import { harvestCpuFlatWindowMs, normalizeStallSnapshot, WorkerTreeCpuAccountant, } from "../run/stall.js";
 export const GATE_PANE_SEP = " · ";
 // v1.64 gate-integrity (repo-scan Tier A·1): the concrete completion-faking shortcuts every
 // judge/review verdict must hunt for. Shared verbatim by the acceptance judge and review prompts.
@@ -94,6 +95,30 @@ export function rolePaneNameFromPrompt(prompt, fallback) {
     return fallback;
 }
 const llmOutputCapture = new AsyncLocalStorage();
+// v2.0 T1 (OBS-555): the empirical healthy-duration p95 is 10.6 minutes. The smallest whole
+// minute above it plus the specified one-minute margin is twelve minutes. This default remains
+// strictly below BOTH unchanged 900_000ms production dispatch timeouts: JUDGE_TIMEOUT_MS in
+// acceptance.ts and reviewGate's literal timeout in review.ts. Scope's 300_000ms call is not a
+// verdict gate and retains its existing one-wait behavior.
+export const GATE_INACTIVITY_WINDOW_MS = 12 * 60_000;
+const GATE_WAIT_SLICE_MS = 30_000;
+let gateInactivityWindowMs = GATE_INACTIVITY_WINDOW_MS;
+/** Test seam — shrink only the calibrated inactivity window; production always reads 12 minutes. */
+export function setGateInactivityWindowMsForTests(ms) {
+    gateInactivityWindowMs = ms;
+}
+export function resetGateInactivityWindowMsForTests() {
+    gateInactivityWindowMs = GATE_INACTIVITY_WINDOW_MS;
+}
+const productionGateCpuAccountant = (marker, cwd) => new WorkerTreeCpuAccountant(marker, cwd);
+let gateCpuAccountantFactory = productionGateCpuAccountant;
+/** Test seam for deterministic measurable/activity/gap samples without platform-specific ps output. */
+export function setGateCpuAccountantFactoryForTests(factory) {
+    gateCpuAccountantFactory = factory;
+}
+export function resetGateCpuAccountantFactoryForTests() {
+    gateCpuAccountantFactory = productionGateCpuAccountant;
+}
 // OBS-132: acceptance.ts owns verdict parsing and is deliberately byte-untouched. This async-scoped
 // recorder lets run-gates observe the exact output that acceptance parsed without changing runLlm's
 // return value or leaking concurrent tasks into one another. Callers retain output only when the
@@ -119,6 +144,8 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
 export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
+    let slot;
+    let accountant;
     try {
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
@@ -131,19 +158,90 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
             adapter.headlessCommand(pf, model),
             gateExitTrailer(nonce),
         ].join("\n"));
-        const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
+        slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
         via.onSlot?.(slot);
         await via.driver.run(slot, paneDispatchCommand(scriptPath));
         // nonce-suffixed exit only: a displayed bare "TICKMARKR_EXIT:" or another call's marker must not
         // false-complete — same guard the worker path uses (daemon.ts:330-331).
-        await via.driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, timeoutMs, { regex: true });
-        const out = await via.driver.read(slot, 400);
-        if (!via.keep)
-            await via.driver.close(slot);
+        const exitPattern = `TICKMARKR_EXIT_${nonce}:\\d`;
+        let out;
+        const gatePrompt = prompt.startsWith("TICKMARKR-JUDGE") || prompt.startsWith("TICKMARKR-REVIEW");
+        if (!gatePrompt) {
+            await via.driver.waitOutput(slot, exitPattern, timeoutMs, { regex: true });
+            out = await via.driver.read(slot, 400);
+        }
+        else {
+            // Review and judge waits are sliced so the two-leg inactivity policy can observe the pane and
+            // the exact dispatch script's process tree between waits. The accountant retains short-lived
+            // descendants with the same semantics as daemon workers; llm.ts depends only on stall.ts.
+            accountant = gateCpuAccountantFactory(scriptPath, cwd);
+            await accountant.start();
+            const startedAt = Date.now();
+            out = await via.driver.read(slot, 400);
+            let priorSnapshot = normalizeStallSnapshot(out);
+            const anchoredAt = Date.now();
+            let quietSince = anchoredAt;
+            const initialCpu = accountant.read();
+            let priorCpuMs = initialCpu.cpu?.ms;
+            let priorGaps = initialCpu.gaps;
+            let cpuFlatSince = initialCpu.cpu === undefined ? undefined : anchoredAt;
+            while (Date.now() - startedAt < timeoutMs) {
+                const remaining = timeoutMs - (Date.now() - startedAt);
+                // The adaptive test-window arm keeps a seam-adjusted case sliced too; production stays 30s.
+                const sliceMs = Math.max(1, Math.min(GATE_WAIT_SLICE_MS, Math.ceil(gateInactivityWindowMs / 4), remaining));
+                const matched = await via.driver.waitOutput(slot, exitPattern, sliceMs, { regex: true });
+                const raw = await via.driver.read(slot, 400);
+                out = raw;
+                // waitOutput is the driver's authoritative marker match. The raw check covers drivers whose
+                // wait timed out at the same boundary the marker landed; either way a trailer completes
+                // normally and is never mistaken for inactivity.
+                if (matched || new RegExp(exitPattern).test(raw))
+                    break;
+                const now = Date.now();
+                const snapshot = normalizeStallSnapshot(raw);
+                if (snapshot !== priorSnapshot) {
+                    priorSnapshot = snapshot;
+                    quietSince = now;
+                }
+                const observation = accountant.read();
+                const cpu = observation.cpu;
+                if (observation.gaps !== priorGaps || cpu === undefined) {
+                    // Missing evidence is a hold-open signal, never guessed inactivity. A later measurable
+                    // sample starts a fresh complete window rather than inheriting quiet time across the gap.
+                    priorGaps = observation.gaps;
+                    priorCpuMs = undefined;
+                    cpuFlatSince = undefined;
+                    quietSince = now;
+                    continue;
+                }
+                if (priorCpuMs === undefined || cpu.ms !== priorCpuMs) {
+                    // Any process-tree CPU movement holds the call open and re-arms both clocks. Equality only
+                    // becomes "flat" after the existing resolution-aware quantum window has elapsed.
+                    priorCpuMs = cpu.ms;
+                    cpuFlatSince = now;
+                    quietSince = now;
+                    continue;
+                }
+                const cpuFlatFor = now - (cpuFlatSince ?? now);
+                const snapshotQuietFor = now - quietSince;
+                if (cpuFlatFor >= harvestCpuFlatWindowMs(cpu.resolutionMs)
+                    && snapshotQuietFor >= gateInactivityWindowMs) {
+                    break;
+                }
+            }
+        }
         return dewrapPaneVerdict(out, nonce);
     }
     finally {
-        rmSync(dir, { recursive: true, force: true });
+        try {
+            await accountant?.stop();
+            if (slot && !via.keep)
+                await via.driver.close(slot);
+        }
+        finally {
+            // Unconditional and synchronous: a stop/close failure must not leak this call's prompt and script.
+            rmSync(dir, { recursive: true, force: true });
+        }
     }
 }
 // OBS-155: a TUI renders the verdict as a bullet and HARD-wraps it at pane width with a 2-space

package/dist/gates/run-gates.d.ts

@@ -4,6 +4,23 @@ import { type GateName, type Task } from "../graph/schema.js";
 import { type Baseline } from "./baseline.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
+export type LoadProvider = () => number;
+/** Test seam — inject deterministic load samples; production always reads os.loadavg. */
+export declare function setLoadProviderForTests(provider: LoadProvider): void;
+export declare function resetLoadProviderForTests(): void;
+/**
+ * One gate's own measurement, taken WHERE THE GATE RUNS. `durationMs` sums that gate's execution
+ * intervals and nothing between them, so the composite `test` gate (a selected screen, then other
+ * gates, then the full suite) reports the two suites' cost rather than the span containing them —
+ * and no consumer has to re-derive a duration by subtracting journal timestamps, which measures the
+ * queue as well as the work. The load samples bracket the FIRST interval's start and the LAST
+ * interval's end: start is what a scheduler would have decided on, end is the state it left behind.
+ */
+export interface GateTelemetry {
+    durationMs: number;
+    load1Start: number;
+    load1End: number;
+}
 export type GateEvent = {
     phase: "start";
     gate: GateName;
@@ -31,6 +48,7 @@ export interface GateContext {
     artifactDir?: string;
     pipeline?: "v185" | "legacy";
     selectTests?: boolean;
+    collateral?: ReadonlyArray<string>;
     onGate?: (e: GateEvent) => void | Promise<void>;
 }
 /**